Ask Your Question
0

Tshark trace for WifiCalling Registration

asked 2018-06-14 21:27:16 +0000

this post is marked as community wiki

This post is a wiki. Anyone with karma >750 is welcome to improve it.

Hello All,

How can i use tshark to filter diameter.User-Name in Wifi Registration scenario where the IMSI has a domain name I have an error message that the symbole "@" confuses the command

[XXXX@WHY-MKTA-1 ~]$ sudo tshark -n -s0 -i bond0.62 -R `"diameter.User-Name==0730030824540655@nai.epc.mnc003.mcc730.3gppnetwork.org"`
tshark: "@" was unexpected in this context.

Thanks

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-06-15 14:47:32 +0000

cmaynard gravatar image

It seems to be a problem of quoting. Try:

sudo tshark -n -s0 -i bond0.62 -Y 'diameter.User-Name=="[email protected]"'

Also notice that I changed -R to -Y; otherwise this command fails as follows (at least with modern versions of tshark):

tshark: -R without -2 is deprecated. For single-pass filtering use -Y.

... and if you attempt to use -2R, you will get:

tshark: Live captures do not support two-pass analysis.
edit flag offensive delete link more

Comments

Thank you so much, was error due to the quoting .

[XXXX@WHY-MKTA-1 ~]$ sudo tshark -n -s0 -i bond0.56 -R 'diameter.User-Name=="[email protected]"'
Running as user "root" and group "root". This could be dangerous.
Capturing on bond0.56
51.742833267  172.16.12.8 -> 172.18.126.70 DIAMETER 670 cmd=Diameter-EAPRequest(268) flags=RP-- appl=Unknown(16777264) h2h=86b6010 e2e=57d9d866
51.953742978 172.18.126.70 -> 172.16.12.8  DIAMETER 490 cmd=Diameter-EAPAnswer(268) flags=-P-- appl=Unknown(16777264) h2h=86b6010 e2e=57d9d866
52.271521983  172.16.12.8 -> 172.18.126.70 DIAMETER 590 cmd=Diameter-EAPRequest(268) flags=RP-- appl=Unknown(16777264) h2h=186cb010 e2e=57d9d867
52.278289892 172.18.126.70 -> 172.16.12.8  DIAMETER 894 cmd=Diameter-EAPAnswer(268) flags=-P-- appl=Unknown(16777264) h2h=186cb010 e2e=57d9d867
^C4 packets captured
aomar gravatar imageaomar ( 2018-06-15 16:15:24 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-06-14 21:27:16 +0000

Seen: 393 times

Last updated: Jun 21 '18